A New York Times report highlighted one particularly invasive example in which Netflix, Spotify and the Royal Bank of Canada were given the ability to read, write and delete the private messages of users.